CVE-2026-14967 — Path traversal in github_workflows allows writing artifacts outside output directory

CVE-2026-14967

Path traversal in github_workflows allows writing artifacts outside output directory PUBLISHED

Description (CNA)

BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configured output directory: its path-containment check did not resolve `..`, so a crafted `CODE_REPOSITORY` URL could traverse out of the intended folder. The write is bounded to two directory levels above the output location and its target is determined by the operator's configuration, not the attacker.

Affected (CNA)

Vendor / product	Versions
Black Lantern Security / BBOT	affected 1.1.7 through 2.8.6

CWE

CWE-22

References

https://github.com/blacklanternsecurity/bbot/commit/c1c6ec05ff998e2fba55a14d1026f12563ccd82f

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.